(12) INTERNATIONAL APPLICATION PUBLISHED UNDER THE PATENT COOPERATION TREATY (PCT) 




(19) World Intellectual Property Organization 
International Bureau 

(43) International Publication Date (10) International Publication Number 

7 March 2002 (07.03.2002) PCT WO 02/19067 A2 



(51) International Patent Classification 7 : G06F 1/00 

(21) International Application Number: PCT/EPO 1/09643 

(22) International Filing Date: 20 August 2001 (20.08.2001) 

(25) Filing Language: English 

(26) Publication Language: English 

(30) Priority Data: 

0021278.7 31 August 2000 (31.08.2000) GB 

(71) Applicant (for all designated States except US): F-SE- 
CURE OYJ [FI/FI]; Tammasaarankatu 7, PL 24, Helsinki, 
FIN-00 180 Helsinki (FT). 



(81) Designated States (national): AE, AG, AL, AM, AT, AU, 
AZ, BA, BB, BG, BR, BY, BZ, CA, CH, CN, CO, CR, CU, 
CZ, DE, DK, DM, DZ, EC, EE, ES, FT, GB, GD, GE, GH, 
GM, HR, HU, ID, IL, IN, IS, JP, KE, KG, KP, KR, KZ, LC, 
LK, LR, LS, LT, LU, LV, MA, MD, MG, MK, MN, MW, 
MX, MZ, NO, NZ, PL, PT, RO, RU, SD, SE, SG, SI, SK, 
SL, TJ, TM, TR, TT, TZ, UA, UG, US, UZ, VN, YU, ZA, 
ZW. 

(84) Designated States (regional): ARIPO patent (GH, GM, 
KE, LS, MW, MZ, SD, SL, SZ, TZ, UG, ZW), Eurasian 
patent (AM, AZ, BY, KG, KZ, MD, RU, TJ, TM), European 
patent (AT, BE, CH, CY, DE, DK, ES, FI, FR, GB, GR, IE, 
IT, LU, MC, NL, PT, SE, TR), OAPI patent (BF, BJ, CF, 
CG, CI, CM, GA, GN, GQ, GW, ML, MR, NE, SN, TD, 
TG). 



(72) Inventor; and Published: 

(75) Inventor/Applicant (for US only): HYPPdNEN, Ari — without international search report and to be republished 
[FI/FI]; Joutsenpolku 25, FIN- 101 60 Degerby (FI). upon receipt of that report 

(74) Agent: LIND, Robert; Marks & Clerk, 4220 Nash Court, For two-letter codes and other abbreviations, refer to the "Guid- 

Oxford Business Park South, Oxford, Oxfordshire OX4 ance Notes on Codes and Abbreviations" appearing at the begin- 



2RU (GB). 



ning of each regular issue of the PCT Gazette. 



= (54) Title: MAINTAINING VIRUS DETECTION SOFTWARE 




(57) Abstract: A method of managing a virus signature database associated with an anti-virus application, both of which are resident 
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network 1 to the device 2,4. In accordance with instructions contained in the management messages, individual signature entries of 
the virus signature database are deleted or replaced, and new signatures added. 
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Maintaining Virus Detection Software 

The present invention relates to maintaining virus detection software and in particular, 
though not necessarily, to maintaining virus detection software for use with mobile 
5 wireless devices. 

The last decade has seen a rapid growth in the number and use of mobile cellular 
telephones. More recently, wireless devices known as "communicators" have been 
introduced and combine the functionality of mobile telephones and Personal Digital 
1 0 Assistants (PDAs). It is expected that this area will undergo massive growth in the near 
future as new cellular telecommunication standards (e.g. GPRS, UMTS, WAP) make 
possible the high speed transfer of data across the wireless interface. 

The next generation of mobile telephones are likely to resemble a mini-computer rather 
15 than a telephone per se. Also, whilst to date cellular telephones have been very much 
manufacturer specific in terms of both hardware and software, future wireless devices 
are likely to be built on a much more open platform. This will allow the introduction 
into the devices of third party applications and will further fuel growth in much the 
same way as Microsoft Windows™ has done for personal computers. 

20 

It can be expected that the opening up of mobile wireless platforms will make such 
platforms susceptible to attack from so-called "malware" such a s viruses, Trojan horses, 
and worms (referred to collectively hereinafter as "viruses") in much the same way as 
the openness of present day PCs and workstations makes them susceptible to malware 
25 attack. A number of mobile telephone viruses have recently been identified in the wild. 
In order to resist virus attacks, anti-virus software will be deployed into mobile 
platforms in much the same way as it has been deployed in the desktop environment. 

A number of different desktop anti-virus applications are currently available. The 
30 majority of these applications rely upon a basic scanning engine which searches suspect 
files for the presence of predetermined virus signatures. These signatures are held in a 
database which must be constantly updated to reflect the most recently identified 
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viruses. Typically, users download replacement databases every so often, either over 
th e Internet, from a received e-mail, or from a CDROM or floppy disc. Users are also 
expected t o update there software engines every so oft en in order to take advantage of 
new virus detection techniques (e.g. which may be required when a wholly new strain 
5 of virus is detected). 



Mobile wireless platforms present a series of problems for software developers 
(including developers of anti-virus software). Chief among these are the limited 
memory and processing power of mobile platforms, and the limited input/output 
10 capabilities which they possess (i.e. no CDROM of floppy drive, and no high bandwidth 
fixed line network o r Internet connectivity). 

According to a first aspect of the present invention there is provided a method of 
managing a virus signature database associated with an anti-virus application, both of 
15 which are resident in a memory of a computer device, the method comprising adding, 
deleting, and replacing individual signature entries of the virus signature database to 
maintain the effectiveness of the database. 

The present invention is applicable in particular to mobile wireless platforms and 
20 devices such as mobile telephones, communicators, and palmtop and laptop computers 
with wireless interfaces. The invention is also applicable to other computer devices 
such as PCs, workstations, etc. 

The inventors of the present invention have recognised that it will be difficult (and 
25 potentially expensive) to download an entire virus signature database to a mobile 
wireless device each time that an update to the database is required. By allowing the 
management of individual signature entries of the database, the updating process 
becomes incremental and is greatly simplified in many respects. For example, in order 
to update the database when a new virus is detected (and a signature generated for that 
30 virus), it is only necessary to download that signature and add it to the database 
(processing requirements are also reduced). 
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Preferably, the method comprises receiving management messages over the wireless 
interface, the management messages containing respective instructions, e.g. add, delete, 
or replace a virus signature. In the case of an add or replace signature instruction, the 
message may be accompanied by a new signature (where the new signature is contained 
5 in the management message or in a separate message). Management messages may be 
pushed to users, i.e. the messages are sent without a request from users, or pulled by 
users, i.e. messages are sent following the receipt of a request from users. 

Preferably, management messages are accompanied by respective sequence numbers. 

10 The anti-virus application, or a management agent, resident in the memory of the 
wireless device uses the sequence number of a received management message to 
determine whether or not one or more preceding management messages have not been 
received. If it is determined that a management message has not been received, the 
application or agent may request that message via the wireless interface. The sequence 

1 5 number may be device or subscriber specific. 

Virus signatures may be relevant to specific mobile wireless devices and to specific 
software. As such, management messages may be filtered either at the origin side of the 
wireless interface, prior to transmission over the wireless interface, or following receipt 
20 at a mobile device, to allow only messages relevant to a particular device (or software 
installed on that device) to be sent to that device or to be acted upon at the device. 

Preferably, said mobile wireless device is a cellular communication device having an 
interface for allowing the device to communicate with a cellular telecommunications 
25 network. For example, the network may be a GSM network or a UMTS (3GPP) 
network. Management messages sent to the device may originate in the network or at a 
third party site in which case the network provides a transit network. 

It will be appreciated that the anti-virus application may be a stand-alone application or 
30 may be embedded in some other application. 
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According to a second aspect of the present invention there is provided a computer 
device having a memory and an anti-virus software application resident in the memory, 
the memory also containing an anti-virus signature database accessible in use by the 
anti-virus application, the apparatus comprising processing means for adding, deleting, 
5 and/or replacing individual signature entries of the virus signature database. 

Preferably, the computer device is a mobile wireless device. 

According to a third aspect of the present invention there is provided a method of 
10 managing a virus signature database associated with an anti-virus application, both of 
which are resident in a memory of a mobile wireless device, the method comprising 
receiving management messages, relating to database or anti-virus application changes, 
at the device, the management messages being filtered either at the origin side of the 
wireless interface or at the mobile device to pass only messages relevant to the recipient 
15 device. 

In certain embodiments of the above third aspect of the present invention, the filter at 
the mobile device or at the origin side of the wireless interface has a knowledge of the 
properties of the mobile device (e.g. make, model) and/or of the software applications 
20 resident on the mobile device. Where the filter exists at the origin side of the wireless 
interface, this information may be sent to the filter from the mobile device. 
Management messages may contain the identity of mobile devices and/or applications 
to which they are relevant, such that the filter may compare the applicability of 
messages to the properties/resident software of destination mobile devices. 

25 

According to a fourth aspect of the present invention, there is provided a method of 
scanning information for the presence of a virus, the method comprising extracting 
predetermined virus signatures from a virus signature database and sequentially 
searching for the presence of signatures in the information, wherein the database 
30 contains for each of one or more viruses a plurality of signatures, and indicating the 
presence or absence of each of said one or more viruses based on a combination of the 
results of the plurality of searches. 



WO 02/19067 



PCT/EP01/09643 



5 



For a better understanding of the present invention and in order to show how the same 
may be carried into effect reference will now be made by way of example to the 
accompanying drawings in which: 
5 Figure 1 illustrates schematically a cellular telecommunications network suitable for 
distributing anti- virus software and database updates; 
Figure 2 illustrates the software architecture of a mobile wireless device; and 
Figure 3 is a flow diagram illustrating a method of updating anti-virus software and an 
associated database of the device of Figure 2 using the network of Figure 1. 



There is illustrated in Figure 1 a Public Land Mobile Network (PLMN) 1 which is the 



tcSS^network^of a subscriber using a,wireless device^ The device 2 illustrated is a 



communicator type device. For the purpose of the following discussion, the PLMN 1 is 
assumed to be a GSM network. A second PLMN 3 is illustrated in the Figure, and this 
15 PLMN may represent a foreign or visited network for a ro aming subscriber (using a 
wireless device 4 comprising a PDA and mobile telephone) whose home network is also 
the PLMN 1. 

A Management Centre^ operated by a third party anti- virus software 
20 manufacturer/distributor is coupled to the PLMN 1 and comprises a Management Server 
6 and a Management Console 7. The Management Server 6 is connected to the 
communication backbone of the PLMN 1, e.g. to an MSC (not shown in* the Figure). 
Via the Management Console 6, the operator is able to se nd SMS messag es and data to 
devices such as the devices 2,4, and receive the same from these devices. It is assumed 
25 that the users of the mobile devices 2,4 have subscribed to a service of the Management 
Centre 5. 

The devices 2,4 each have a memory storage means on which rpgiHag ring operating } 
syste m of the device. This may be for example EPOC or Windows CE™. A number of 
30 application programs are pre-loaded by the manufacturer or by the device supplier into 
the memory. These applications may comprise a phone application (used for making 
and controlling phone calls), a contacts database, and a word processor. The memory 



10 
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also contains an anti-virus application which may be a standalone application, part of a 
suite of security applications, or may be integrated into some other application. Figure 
2 illustrates a part of the software architecture of a mobile device 2,4. 

5 The core of the anti-virus application is a virus scanning engine 8 which may resemble 
for example the scanning j^gme r of4he-F^^ product family of F- 

Secure Oyj (Espoo, Finland). Associated with th e scanning enginej is a virus signature 
database 9 which contains a sequence of virus signatures. The basic database structure 
is created when the anti-virus application is installed into the device 2,4. At the same 

10 time, the database 9 is populated with known virus signatures. In order to reduce the 
memory space occupied by the database 9, the virus signatures may be relatively short 
compared to the length of conventional anti-virus signatures. However, for certain 
viruses, this shortening of the virus signature may lead to a significant loss in the 
certainty with which viruses may be detected (and to an increase in false alarms). To 

15 overcome this problem, for certain viruses a plurality of signatures may be inserted into 
the database 9. These signatures may be linked or "chained 11 together, such that a virus 
warning is only generated if all (or possibly a subset of) signatures are identified in a 
scanned file. Multiple signatures may also be used to generate a detection confidence 
estimate. 

20 

Also installed into the device's memory is a management agent 10. The management 
agent 10 is responsible for maintaining the database 9 and the antivirus software 8 in 
j-esponse to management messages received fr om the J^^ ^m^Tc entre 
wirelessinterfa^. The management messages may be sent using any suitable bearer 
25 such as a circuit switched or packet switched data connection (e.g. during a WAP 
session), or the Short Message Service (SMS) in GSM networks. The management 
agent 10 can access individual records of the virus signature database 9 to either enter 
new signatures into blank records, delete current signatures, or replace an existing 
signature. The management agent is also able to execute softwar e patches in order to 
30 update the anti-virus scanning engine 8. " 
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A management message sent from the Management Centre 5 to a mobile device 2,4 
typically comprises a header portion which contains a subscriber specific sequence 
number, and a flag indicating whether the management message relates to a software or 
database update. In the case of a database update, the header will also include a 
5 database entry number, and an instruction. Each time a new message is sent from the 
Management Centre 5 to a device, the sequence number is incremented by 1. In order 
to ensure that messages can be authenticated by a receiving device, messages are 
cryptographically signed at the Management Centre 5. 

10 Following receipt of a management message at a mobile device 2,4, the message is 
passed to the management agent 10 where the cryptographic signature is checked. 
Assuming that the message is indeed authenticated, the management agent first 
compares the sequence number contained in the header with the sequence number of the 
last received message. In the event that the sequence number of the new message is the 

15 next expected sequence number, the updating procedure can proceed as described 
below. In the event that the sequence number of the new message is not the next 
expected sequence number, an error report is generated. This causes the management 
agent 10 to identify the missing updates and to request these (in order) from the 
Management Centre 5. 

20 

In the event that the sequence number of a received message is as expected, the 
management agent 10 determines whether or not the message relates to a software or 
database update. In the former case, the agent causes the update to be executed, 
automatically updating the software using an executable file contained in the payload of 

25 the message. In the latter case, the management agent 10 examines the database entry 
number and the instruction of the message header. The database entry number identifies 
a position in the database 9 which is to be operated upon, and the instruction identifies 
an operation such as ADD_NEW_SIGNATURE, DELETE_EXISTING_SIGNATURE, 
or REPLACE_EXISTING_SIGNATURE. The message may contain a payload section 

30 for carrying data. For example, this data could be a new or replacement virus signature. 
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At the Management Centre 5, new virus signatures will be created as and when new 
viruses are detected. This will cause management messages containing the 
ADD_NEW_SIGNATURE instruction to be sent to subscribers. In some cases, an 
improved signature for a known virus may be generated, in which case a management 
5 messages containing the REPLACE_EXISTING_SIGNATURE instruction is sent to 
subscribers. Occasionally, a virus signature sent previously to subscribers may later be 
found to be ineffective, or may be found to generate false alarms, in which case a 
management message containing the DELETE_EXISTING_SIGNATURE instruction 
is sent to subscribers. 

10 

An update filter 1 1 is located at the Management Server 6 of the Management Centre 5. 
All management messages pass through this filter 11. The filter 11 contains a 
subscriber database, and for each subscriber recor ds the manufactu rer and model, 
number of their mobile devices. T he database may also recordj igtajlsj^ 
15 installed in subscriber devices. This information may be collected during the subscriber 

£ ' . . 

registration process, or may be collected dynamically. Management messages contain 
in their headers, or are accompanied by, information identifying the devices and/or 
applications to which they are applicable. This information allows th e filters to direct 
messages jpnly to those devices to which the messages ^expropriate. This achieves a 
20 significant reduction in the use of the wireless interface resources, as well as a reduction 
in the processing requirements placed on the mobile devices. The sequence number is 
added to the header of a management message only after the message has passed 
through the filter. This ensures that the sequence number is device specific. 

25 Figure 3 is a flow diagram further illustrating a method of updating anti-virus software 
and signature databases using the network of Figure 1. 

It will be appreciated by the person of skill in the art that various modifications may be 
made to the above described embodiment without departing from the scope of the 
30 present invention. Systems may be designed in which software or database updates are 
automatically sent to mobile devices (i.e. updates are pushed to mobile devices), or' 
where the updates are sent following a requests from mobile devices (i.e. updates are 
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pulled to mobile devices). In another modification to the described embodiment, the 
filter present at the Management Centre 5 may be informed of the properties of a 
destination mobile device during a communication session, e.g. based on the http 
headers sent from a browser of a device during a WAP session. In yet another 
5 modification to the described embodiment, a management message may relate to a 
plurality of virus database entries. For example, the message may identify two database 
records with the payload containing two respective new signatures. In yet another 
modification to the described embodiment, the management message may comprise a 
sequence of packets which are concatenated upon reception at the mobile device. In yet 
10 another modification to the described embodiment, the management message may 
identify an address (e.g. a WAP or WWW URL) from where a new signature may be 
downloaded. There is thus no need to include the signature in the message itself. 



WO 02/19067 PCT/EP01/09643 

10 

CLAIMS: 



1. A method of managing a virus signature database associated with an anti-virus 
application, both of which are resident in a memory of a computer device, the method 

5 comprising adding, deleting, and replacing individual signature entries of the virus 
signature database to maintain the effectiveness of the database. 

2. A method according to claim 1, wherein said computer device is a mobile 
wireless platform. 

10 

3. A method according to any one of the preceding claims and comprising 
\ receiving management messages over the wireless interface, the management messages 

containing respective add, delete, or replace virus signature instructions. 

\' 

\ , - * 

15 4. A method according to claim 3, wherein in the case of an add or replace 
signature instruction, the message is accompanied by a new signature. 



5. A method according to any one of the preceding claims, wherein management 
messages are accompanied by respective sequence numberis and the anti-virus 

20 application, or a management agent, resident in the memory of the wireless device uses 
the sequence number of a received management message to determine whether or not 
one or more preceding management messages have not been received. 

6. A method according to claim 5, wherein, if it is determined that a management 
25 message has not been received, the application or agent requests that message via the 

wireless interface. 

7. A method according to any one of the preceding claims and comprising filtering 
management messages either at the origin side of the wireless interface, prior to 

30 transmission over the wireless interface, or following receipt at a mobile device, to 
allow only messages relevant to a particular device or software installed on that device 
to be sent to that device or to be acted upon at the device. 
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8. A method according to any one of the preceding claims, wherein said mobile 
wireless device is a cellular communication device having an interface for allowing the 
device to communicate with a cellular telecommunications network. 

5 

9. A computer device having a memory and an anti-virus software application 
resident in the memory, the memory also containing an anti-virus signature database 
accessible in use by the anti-virus application, the apparatus comprising processing 
means for adding, deleting, and/or replacing individual signature entries of the virus 

1 0 signature database. 

10. A device according to claim 9, wherein the computer device is a mobile wireless 
device. 

15 11. A method of managing a virus signature database associated with an anti-virus 
application, both of which are resident in a memory of a mobile wireless device, the 
method comprising receiving management messages, relating to database or anti-virus 
application changes, at the device, the management messages being filtered either at the 
origin side of the wireless interface or at the mobile device to pass only messages 

20 relevant to the recipient device. 

12. A method according to claim 1 1, wherein the filter at the mobile device or at the 
origin side of the wireless interface has a knowledge of the properties of the mobile 
device and/or of the software applications resident on the mobile device. 

25 

13. A method according to claim 1 1 or 12, wherein the filter exists at the origin side 
of the wireless interface, and properties of the mobile device and/or of the software 
applications resident on the mobile device are sent to the filter from the mobile device. 

30 14. A method according to any one of claims 11 to 13, wherein the management 
messages contain the identity of mobile devices and/or applications to which they are 
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relevant, such that the filter may compare the applicability of messages to the 
properties/resident software of destination mobile devices. 

15. A method of scanning information for the presence of a virus, the method 
5 comprising extracting predetermined virus signatures from a virus signature database 
and sequentially searching for the presence of signatures in the information, wherein the 
database contains for each of one or more viruses a plurality of signatures, and 
indicating the presence or absence of each of said one or more viruses based on a 
combination of the results of the plurality of searches. 
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